A managed service provider hosts several customer environments on one ONTAP cluster. Each customer's SVM must use its own IP address space and routing table to maintain network isolation. Which ONTAP feature provides this isolation?

A managed service provider hosts several customer environments on one ONTAP cluster. Each customer's SVM must use its own IP address space and routing table to maintain network isolation. Which ONTAP feature provides this isolation?

• A. VLAN tagging within LIFs
• B. SVM-specific routing domains and LIFs
• C. FlexGroup member volume isolation
• D. Intercluster LIF firewalls

Answer: (D)

The ability to give each customer its own IP space and routing context is achieved by using SVM-specific routing domains and LIFs. In ONTAP, an SVM (Storage Virtual Machine) can have its own separate routing domain, and LIFs (logical interfaces) are bound to that SVM. This means each tenant can have distinct IP networks and a dedicated routing table (and even per-SVM routing protocols if desired), so traffic stays within the tenant’s namespace and isn’t mixed with others. VLAN tagging can separate traffic at the network boundary but doesn’t automatically create separate IP space and routing contexts for each SVM; FlexGroup isolation deals with data placement, not network isolation; and intercluster LIF firewalls protect traffic across clusters rather than providing per-SVM network namespaces. Thus, SVM-specific routing domains and LIFs provide the required isolation.

The ability to give each customer its own IP space and routing context is achieved by using SVM-specific routing domains and LIFs. In ONTAP, an SVM (Storage Virtual Machine) can have its own separate routing domain, and LIFs (logical interfaces) are bound to that SVM. This means each tenant can have distinct IP networks and a dedicated routing table (and even per-SVM routing protocols if desired), so traffic stays within the tenant’s namespace and isn’t mixed with others. VLAN tagging can separate traffic at the network boundary but doesn’t automatically create separate IP space and routing contexts for each SVM; FlexGroup isolation deals with data placement, not network isolation; and intercluster LIF firewalls protect traffic across clusters rather than providing per-SVM network namespaces. Thus, SVM-specific routing domains and LIFs provide the required isolation.